System and methods for automated collection, aggregation, distribution, display, and recording of alert related information

ABSTRACT

Disclosed herein is a system for handling critical incidents form external control, information and networking systems. In one embodiment, the system includes a mapping module, a presentation formatting module, a distribution module, and a least one display device (i.e., computer, mobile device, video wall display). The mapping module is configured to receive alert information from external systems, search for information relevant to the critical incident, and aggregate the alert information and relevant information into a persistent arrangement that maps the source of such information. The presentation formatting module is configured to define a visual data presentation that allows for displaying alert information and relevant information in a useful format. The distribution module is configured to send the visual data presentation to one or more end-points. The display device(s) is located at such an end-point(s) and configured to receive and display the visual data presentation to personnel responsible for mitigating and curing the critical incident.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to U.S. Provisional Patent ApplicationNo. 63/161,529 titled “System and Method for Automatic Collection,Aggregation, Distribution, and Display of Alert Related Information,”filed on Mar. 16, 2021, the disclosures of this patent application beingincorporated herein by reference in their entirety.

FIELD OF INVENTION

The present disclosure relates to the field of automated alertsgenerated by monitoring applications in communication with acommunication method and arranged to monitor hardware and software foroccurrences of critical incidents. More particularly, the presentdisclosure relates to a system and method for facilitating thecollection of alert data for a critical incident; gathering andaggregating additional information relevant to the critical incident,including visual information; and distributing and displaying suchcritical incident alert data and relevant information to multipledisparate display devices in communication with the communication methodto efficiently inform and facilitate collaboration between individualsresponsible for the critical incident.

BACKGROUND

It is known that systems and dedicated software applications cangenerate alarm or alert trigger events corresponding to critical statesof operation or failure of system functionality and/or systemcomponents. Alarm and alert conditions can manifest as any type ofinformation sent by an application over a communication method, such asan internet protocol network with protocols including httpnotifications, events, incidents, SNMP traps, emails, or SMS messages.Some systems can send alerts via different connectivity equipment andmethods such as serial cables using RS-232/432 protocols or other suchknown connectivity equipment and methods. The purpose of sending alertsover a communication method is to alert personnel responsible formitigating and/or correcting the issues underlying the alert. However,known systems and methods for generating alarm and alert trigger eventsare limited in that they are not sufficiently automated or integrated toefficiently gather all available relevant information in real-time anddeliver such information to the personnel responsible for correcting ormitigating the underlying failure. Thus, known systems and methods failto provide the responsible personnel with the best and most completeinformation regarding the alert, which limits the ability to correctlyand timely address the underlying failure that generated the alarm oralert.

There is a need for systems and methods that provide organizationalteams tasked with managing and correcting critical incidents withalignment and coordination with relevant business resources andoperational objectives required for efficient resolution to criticalincidents. Additionally, there is a need for systems and methods capableof managing alert information transmitted in various formats and variouscommunication methods. Described herein are novel methods and systemsthat facilitate automated, real-time, non-human-input-based distributionof critical incident data and relevant information, including visualinformation, to maintain situational awareness and for the purpose ofimproving the timeliness and effectiveness of responses to such criticalincidents.

SUMMARY

Disclosed herein are systems and methods for efficiently managingcritical incidents in a timely and efficient manner. Such systems andmethods provide for the detection of alert information describing acritical incident for an external computer or networking system, thestandardization of such alert information, the collection andaggregation of additional information relevant to the critical incident,the formatting of alert information and additional relevant informationfor efficient visual display, and the distribution of the alertinformation and additional relevant information for display on disparatedisplay devices accessible to personnel responsible for mitigating andcuring the critical incident. Additionally, the systems and methods canprovide for collaboration between responsible personnel to resolve thecritical incident and the recording and documenting of actions taken bythe systems and/or users of the systems during applicable methods forsubsequent review and analysis.

In one embodiment, a system includes a mapping module, a presentationformatting module, a distribution module, and at least one displaydevice. The mapping module is configured to receive alert informationfrom an external system, search for additional information relevant tothe critical incident, and aggregate the alert information and relevantinformation into a persistent arrangement that maps the source of suchinformation. The presentation formatting module is configured to definea visual data presentation that arranges lists of visual sources in aformat that is useful for displaying visual depictions of alertinformation and relevant information. The distribution module isconfigured to send the visual data presentation to one or moreend-points. The display device(s) is located at such an end-point andconfigured to receive and display the visual data presentation.

Examples of display devices include, for example, a video wall display,personal computer devices such as desktop and laptop computers, andmobile devices such as smartphones and tablets. Such display devices aretypically accessible to personnel responsible for mitigating or curingthe critical incident. The system can additionally include collaborationtools that allow personnel viewing the visual data presentation toprovide analysis and commentary or present questions to other personnelconcurrently viewing the visual data presentation. Such collaborationcan include adding content via a graphical whiteboard, text messages,and audio communications. The system can further be arranged to includea recording module that records and stores the visual data presentationand any systematic revisions to the visual data presentation along withall content contributed by personnel through the collaboration process.

BRIEF DESCRIPTION OF THE DRAWINGS

In the accompanying drawings, structures are illustrated that, togetherwith the detailed description provided below, describe exampleembodiments of the claimed invention. Where appropriate, like elementsare identified with the same or similar reference numerals. Elementsshown as a single component can be replaced with multiple components.Elements shown as multiple components can be replaced with a singlecomponent. The drawings may not be to scale. The proportion of certainelements may be exaggerated for the purpose of illustration.

FIG. 1 schematically illustrates an overall system structure disclosedherein.

FIG. 2 schematically illustrates a portion of the system structure ofFIG. 1 , namely a mapping module and related components of the overallsystem.

FIG. 3 schematically illustrates a portion of the system structure ofFIG. 1 , namely a recording module and related components.

DETAILED DESCRIPTION

The apparatus, arrangements, and methods disclosed in this document aredescribed in detail by way of examples and with reference to thefigures. It will be appreciated that modifications to disclosed anddescribed examples, arrangements, configurations, components, elements,apparatus, methods, materials, etc. can be made and may be desired for aspecific application. In this disclosure, any identification of specifictechniques, arrangements, methods, etc. are either related to a specificexample presented or are merely a general description of such atechnique, arrangement, method, etc. Identifications of specific detailsor examples are not intended to be and should not be construed asmandatory or limiting unless specifically designated as such. Selectedexamples of apparatus, arrangements, and methods for facilitating themanagement and handling of critical incidents are hereinafter disclosedand described in detail with reference made to FIGS. 1-3 .

Generally, novel methods and systems disclosed herein are directed toautomated systems that provide useful and relevant information in atimely manner for addressing failures in computer and networkingsystems. Such a novel system is useful in addressing incidents such as,for example, failure or faulty performance of hardware or softwarecomponents of a computer or networking system; acts such as a breach ofcomputer systems by unauthorized third parties for malicious purposes;external occurrences such as power outages, loss of critical third-partyservices, fire, natural disasters, and physical intrusion; and othersuch noteworthy incidents (i.e., a “critical incident”). Such criticalincidents generate alerts that are tracked and managed by the novelmethods and systems disclosed herein to successfully cure, mitigate, orotherwise address the critical incident through the collection,aggregation, distribution, and display of alert information andadditional relevant information to personnel dedicated to monitoring andcorrecting such critical incidents (such personnel shall be referred toherein as “response team”).

As will be discussed in detail herein, such novel methods and systemsinclude a number of physical components, software components, andprocesses useful in collecting and aggregating disparate information anddata relevant to a critical incident and distributing such informationand data to a decentralized response team to analyze, address, mitigate,and/or cure the critical incident. The methods and systems disclosedherein provide such data and information regarding a critical incidentin a format and data structure that can be displayed at various physicallocations and on a variety of display devices, such as, for example, avideo wall display, personal computers, mobile devices, and the like, sothat the response team can efficiently and accurately access and analyzethe critical incident, form an action plan, and execute that action planto correct or mitigate the critical incident.

The methods and systems disclosed herein further provide recordingfunctionality so that a record is created for the critical incident thatincludes the data and information gathered with regard to the criticalincident and the response teams' responsive actions. Such a recordingcan be useful, for example, as a teaching tool for new members of theresponse team, to improve the system and performance of the responseteam through post-event analysis, and for archival purposes.

The methods and systems disclosed herein further provide collaborationtools that offer the response team the functionality necessary toefficiently communicate with decentralized personnel to convey analyses,ideas, questions, and other information useful in addressing,mitigating, and/or curing the critical incident. An example of such acollaboration tool is whiteboarding functionality, where a member of theresponse team can add content to the displayed information that can beimmediately viewed by all members of the response team. Additionalcollaboration tools include instant text messaging, audiocommunications, and the like. The collaboration tools also allow amember of the response team to share all or a portion of the displayedinformation with personnel outside the response team to gain access tospecific expertise and additional opinions to address the criticalincident.

Generally, novel systems as disclosed herein include some or all of thefollowing components and functionality: functionality embedded in one ormore external systems to generate alert information in response to acritical incident; one or more data systems that store information anddata relevant to critical incidents; a mapping module that can receiveand combine the alert information and results from queries of the datasystems relevant to the critical incident; a presentation formattingmodule that organizes the visual data and information in a format thatis useful across different display hardware; a distribution module todistribute the data and information to such different display hardware;display hardware such as a video wall display, personal computers, andmobile devices; a recording module; collaboration tools that provide formembers of the response team to add comments and content regarding thecritical incident; and functionality for sharing information with peopleoutside the response team, all of which are interconnected by acommunication method.

For the purposes of this disclosure, a communication method can be anyarrangement of hardware and software that provides for electroniccommunication between components of a system, including, but not limitedto, RS-232/432 protocols, local-area networks, wireless local-areanetworks, wide-area networks, virtual private networks, and combinationsthereof, using any number of known protocols.

An exemplary critical incident alert system 100 is schematicallyillustrated in FIG. 1 . The critical incident alert system 100 can bearranged to monitor any number of external computer systems andnetworking systems located at any number of geographically disparatelocations. For example, a manufacturing company can arrange such acritical incident alert system 100 to monitor its computer andnetworking systems located at a dozen manufacturing plants spread acrossa dozen geographic regions. Each of these manufacturing plants caninclude hardware and/or software components that comprise a monitoringsystem 110 that actively monitors any number of relevant computer andnetworking systems at the specific manufacturing plant. Such monitoringsystems 110 can be integral into the computer or networking system it ismonitoring. Upon the occurrence of a critical incident, the applicablemonitoring system 110 senses the critical incident and collects and/orgenerates data and information regarding the critical incident (i.e.,“alert information”). The applicable monitoring system 110 is arrangedto send such alert information over a communication method to additionalcomponents of the critical incident alert system 100 for furtherprocessing and analysis.

In one arrangement, the alert information is sent to a mapping module120. The mapping module 120 is arranged such that it receives the alertinformation from the applicable monitoring system 110, analyzes thealert information, and determines the nature of the criticalincident(s). Once the nature of the critical incident is determined, themapping module 120 communicates with one or more applicable data systems130 to conduct and perform searches for information relevant to theapplicable critical incident. Each data system 130 includes one or moredatabases 140 that organize and store such additional data. The data andinformation in such data systems 130 can include, for example, visualinformation such as graphical data, dashboards, tabular data, videostreams from surveillance cameras, news reports, weather broadcasts anddata, maps, photographs, video clips, webpages, and social media posts.Such data systems 130 and databases 140 are often external to thecritical incident alert system 100 and can include public databases anddatabases accessible via subscription services. Once such searches ofthe databases 140 are completed, data and information relevant to theapplicable critical incident is sent to the mapping module 120.

Once the mapping module 120 gathers all relevant data and informationfrom searches of the data systems 130, the mapping module 120 groups allinformation gathered into a useful format and data structure that mapsthe alert information and additional relevant information to the sourceof such information. The mapping module 120 then sends the aggregatedinformation to a presentation formatting module 150, where allinformation is formatted into a visual data presentation 160 that isarranged to be effectively visually displayed at end-points. As usedherein, the term “end-points” refers to the location of a display device(at which a response team member can view the visual data presentation)or a recording device that will utilize the visual data presentation160. As will be understood, the visual data presentation 160 is arrangedso that the response team can efficiently understand the nature of thecritical incident and the known circumstances so that the response teamcan quickly develop a plan to respond to the critical incident. In oneexample, metadata gathered by the system can be displayed to users ofthe system as text within the visual data presentation if it is the typeof information that is useful to the response team. The functionality ofthe mapping module 120 is further discussed herein below with referenceto FIG. 2 .

Visual data in the presentation formatting module 150 is formatted in avisual data presentation 160, which is to say that the visual data isdefined as a standardized, persistent data structure that is useful forvarious purposes. A visual data presentation 160 can be consistentlydisplayed on any number of different display hardware, such as a videowall display, personal computers, and mobile devices. As will beunderstood, such a visual data presentation 160 delivers a consistentvisual presentation to each of the response team members, which allowsthe response team to coordinate their efforts even if each member is ina different location and using different display hardware.

The visual data presentation 160 is distributed over one or morecommunication methods to various rendering end-points via a distributionmodule 170. As previously discussed and schematically illustrated inFIG. 1 , examples of such end-points include video wall displays 180,which can be used in a centralized location where multiple members ofthe response team may be located; personal computing devices, such asoffice computers 190 and home computers 200, for response team membersthat are located in various offices or working remotely from home; andmobile devices 210, for response team members that are away from theoffice, but need to quickly react to the critical incident; and arecording system 220. The visual data presentation 160 is arranged anddistributed such that the visual data presentation 160 can beinteractive in nature through the use of collaborative tools suchwhiteboard functionality, text communication, and voice communication.Such collaboration allows disparately located response team members toefficiently share ideas, formulate a response plan, and execute uponthat response plan.

With reference to FIG. 2 , for each critical incident occurring to amonitored computer or networking system, an alert information packet 230is generated. Because the monitoring systems 110 are not uniform andconsistent, the alert information packet 230 can manifest as any type ofinformation that can be sent via a communication method. For example, IPbased protocols such as http notifications, events, incidents, SNMPtraps, emails and SMS messages can be used. In addition, monitoringsystems 110 can transmit alert information packets 230 over differentconnectivity media such as, for example, serial cables using RS-232/432protocols. If not accounted for, such variability in the performance ofthe monitoring systems 110 can result in omission of available visualdata related to an applicable critical incident due to the use ofdifferent communication methods and formats. The novel system and methoddisclosed herein is arranged to manage alert information packets evenwhen disparate monitoring systems 110 send alert information packets 230using different formats and different communication methods.

In order to handle different communication methods and different formatsof alert information packets 230 coming from various external monitoringsystems 110, the mapping module 120 includes multiple plugin inputcomponents 240 (two such plugin input components are illustrated on FIG.2 ). Each plugin input component 240 is dedicated to and managescommunication with specific monitoring systems 110. Such plugin inputcomponents 240 are arranged to use a particular communication methodprotocol or method to communicate with a specific type of monitoringsystem 110 to receive alert information packets 230 or to proactivelyretrieve alert information packets 230 from specific types of monitoringsystems 110. Plugin input components 240 can also define and exposespecific interfaces to communication with the critical incident alertsystem 100. In certain circumstances, when monitoring systems 110 arenot arranged to send alert information packets to the critical incidentalert system 100, a plugin input component 240 can be arranged toretrieve external data and information and search for applicable alertinformation packets 230.

The plugin input components 240 manage the alert information packet 240,as required, to generate a standardized alert 250 that can beconsistently handled by the critical incident alert system 100. Thestandardized alert 250 includes the alert information and applicablemetadata. A search module 260 within the mapping module 120 is arrangedto conduct searches using standardized alerts 250. The search module 260uses the alert information and metadata of the standardized alert 250 toconduct searches of the various databases 140 within the data systems130. As previously noted, such searches identify and retrieve data andinformation, including visual data, that is relevant to the applicablecritical incident. The mapping module 120 includes communicationcomponents 270 arranged to interact with the data systems 130 toretrieve such relevant data and information from the applicabledatabases 140 using standards and protocols specific to the applicabledata systems 130. In one example, a communication component 270 isarranged to connect to and interact with an external data system 130that is a video management system (VMS) to search databases 140 in theVMS for video streams from specific cameras based on the geo-positionmetadata in the standardized alert 250.

Once the relevant data and information is retrieved from data systems130, the retrieved data (represented by AD1-AD4 in FIG. 2 ) istemporarily stored in the search module 260. The mapping module 120 thenprocesses the information within the standardized alert 250 and theretrieved relevant information to map each portion of information to itsrespective visual sources (represented by S1-S4 in the Figures) andstores the information and applicable mapping in a storage module 280.These mapped sources are used to create the visual data presentation 160arranged in the presentation formatting module 150, which presents dataand information relevant to the critical incident in an organized anduseful format. One example of a visual data presentation 160 is a matrixmade up of visual sources (the visual data presentation 160 in FIGS. 1and 2 is exemplarily illustrated as a 2×2 matrix). Such a matrixpresentation can include a first visual segment displaying dashboardgraphical data rendered in the browser, a second visual segmentdisplaying a satellite image, a third visual segment displaying asurveillance video camera livestreams, and a fourth visual segmentdisplaying a live view of specific application screens.

The visual data presentation 160 can be formatted and arranged in thepresentation formatting module 150 by defining source data type, sourcelocation, and size defined in visual pixel space. In such anarrangement, the visual data presentation 160 can be viewably renderedon any display device located at an end-point such as a video walldisplay 180, a monitor of an office 190 or home 200 computer, a screenof a mobile device 210, or recording system 220. The various visualsources (visual segments) contained in the visual data presentation 160are defined to accommodate a certain visual data presentation overallpixel size. It includes source number, location, size, aspect ratio,visual quality, etc.

The distribution module 170 includes functionality for sending the videodata presentation 160 to various end-points so that the visual datapresentation 160 can be rendered uniformly on a variety of displaydevices. As will be appreciated, rendering of the visual datapresentation 160 is specific to each targeted end-point and thearrangement of the visual data presentation 160 is different for eachspecific display device associated with a targeted end-point. Forexample, a video wall display 180 is controlled by a display node 290.Thus, the distribution module 170 arranges the visual data presentation160 to be rendered on the video wall display 180 via the display node290. Similarly, the distribution module 170 appropriately prepares thevisual data presentation 160 to be properly rendered on other end-pointssuch as personal computers 190, 200, mobile devices 210, and recordingmodule 220.

A video wall display 180, also referred to as video wall system or videowall application, consist of multiple displays (i.e., monitors)controlled by the display nodes 290. The monitors are typically arrangedin an array, where the monitors are controlled to function as a singlevideo display with total number of available pixels that far exceedswhat is available on single display. The display node 290 is arranged toreceive definition and automatically render one or multiple visual datapresentations 160 on the array of monitors. Location and size of thatvisual data presentation 160 is limited only by the number of pixelsavailable on the video wall display 180 and the arrangement of thevisual data presentation 160 by the distribution module 170.

The distribution module 170 is also arranged to send notifications tothe various end-points to notify members of the response team thatinformation regarding a critical incident is available. Suchnotifications can be generated automatically by the distribution module170 as soon as the visual data presentation 160 is formatted and readyfor distribution to the end-points. Notifications include the definitionof the visual data presentation 160 that corresponds to the standardizedalert 250. After receiving a notification, a member of the response teamcan actively render (i.e., open and view) the visual data presentation160 on a preferred display device or any available display device anddirectly view the visual information relevant to the critical incident.

Additionally, the critical incident alert system 100 providesinteractive, visual collaboration methods that allow each member of theresponse team to share the visual data presentation 160 with otherpersonnel or organizations available via any communication method. Suchsharing includes redistribution of a visual data presentation 160, sothat such other personnel can render a visual data presentation 160separately on a chosen display device, or by sharing only a part of theresponse team member's screen so as to share only relevant portions ofthe visual data presentation 160 with the additional personnel. Certainmethods allow for collaboration by adding, removing and interacting withthe visual content displayed. Other methods allow sharing of the visualdata presentation 160 with personnel that do not have access to or theability to render visual data presentation 160. Collaboration sessionscan include whiteboarding over visual content, text messages, and audiocommunication between response team members. In addition, “read only”visual data presentations 160 can be shared outside the response team asa published alert rendered in a webpage.

The recording module 220 is arranged to continuously record the visualdata presentation 160 as arranged in the presentation formatting module150 (and any systematic modifications to the visual date presentation160 over time) and all actions taken by the response team during allcollaboration sessions, including modifying, adding, and editinginformation, voice communication, text communication, and whiteboarddrawing. Such recordings are indexed by critical incident and can beanalyzed and reviewed for training and for forming action plans toimprove responses to critical incidents.

In reference to FIG. 3 , data and information sent to the recordingmodule 220 from the distribution module 170 can consist of visual datacomponent 310 and audio data components 300. Visual data components 310includes the visual data presentation 160 defined by the presentationformatting module 150 and additional visual data components added in byusers during collaboration sessions such as whiteboard drawing overlays320 on top of the visual data presentation 160 and text communications330 added by users during collaboration sessions such as interactivechats. Audio data components 300 such as voice communication fromcollaboration sessions are handled separately as an additional audiodata channel as illustrated in FIG. 3 .

The rendering module 340 brings together the visual data presentation160, visual data components 310 added in by users during collaborationsessions 320, and text communications added by users duringcollaboration sessions 330 into one consistent video rendering in asimilar way as described herein with regard to the visual displaypresentation 160. Such a consistent video rendering is arranged so thatit can be displayed on hardware such as a video wall, a personalcomputer, or a mobile device in the future in an on-demand basis. Thus,the results in video data from collaboration sessions 345 beingformatted in a consistent manner and includes the visual datapresentation 160 and whiteboard drawing overlays 320 and textcommunication 330 added during the collaboration sessions.

This video data 345 from rendering module 340 is captured by a dedicatedcapturing module 350 and formatted in a synchronized data formattogether with audio data components 300 such as voice communicationcaptured during collaboration sessions. All the video and audio data andinformation gathered by the rendering module 340 can be archived in thestorage module 360 to be recalled on demand as required. Such data andinformation can be stored in form of specialized indexed computer filesor captured video streams and stored in storage module 360.

The recording module 220 further includes a playback distribution module370 that, upon demand, retrieves data and information from the storagemodule 360 and makes it available via a data stream 380 to users via avariety of end points such as personal computers, mobile devices, andvideo walls. The standards of the data stream 380 for distributing therecorded session can vary from proprietary file format to industrystandard file encoding such as H.265, mpeg, and the like. In someembodiments, the capturing module 350, the storage module 360, and theplayback distribution module 370 can be implemented externally byspecialized video capture recording systems.

An example of the novel system and method in operation is described inthe context of a network-operations center losing network connectivitydue to fire. The critical incident results in a monitoring systemgenerating a high-level alert and alert information in response to theloss of network connectivity. The alert information, in the form of analert information packet, is sent to the mapping module. The mappingmodule standardizes the alert information packet and sends queries toaccessible data systems arranged to retrieve additional relevant dataand information, including visual information, regarding the criticalincident. In this instance, this visual information can include relevantnetwork performance dashboards from different monitoring applications,surveillance video camera feeds of the facility where the criticalincident occurred, and even local news broadcasts if relevant to thecritical incident. The data and information is mapped to its source andorganized and formatted into a visual data presentation suitable fordistribution to display devices at multiple end-points accessible toresponse team members regardless of the location of any member. Adistribution module then sends the visual data presentation to thevarious end-points. The response team views the information and inreal-time collaborates using voice communications, texts, whiteboarding,and other collaboration tools to addresses and resolve the criticalincident. The information and data for the critical incident along withthe activities of the response team is recorded for the purposes ofpost-incident analysis and training.

The foregoing description of examples has been presented for purposes ofillustration and description. It is not intended to be exhaustive orlimiting to the forms described. Numerous modifications are possible inlight of the above teachings. Some of those modifications have beendiscussed, and others will be understood by those skilled in the art.The examples were chosen and described in order to best illustrateprinciples of various examples as are suited to particular usescontemplated. The scope is, of course, not limited to the examples setforth herein, but can be employed in any number of applications andequivalent devices by those of ordinary skill in the art.

The invention claimed is:
 1. A method for automating the collection,aggregation, distribution, and display of alert information, comprisingthe steps of: receiving alert information regarding a critical incidentfor a computer, telecommunications, or electrical system; searching inan automated manner accessible systems and databases for relevantinformation for the critical incident; aggregating the alert informationand relevant information into a persistent arrangement that maps theinformation to the source of the information; formatting the informationinto a visual data presentation for display across multiple displaydevices; distributing the visual data presentation to one or moreendpoints; and displaying the visual data presentation at the one ormore end-points.
 2. The method of claim 1, wherein the end-pointincludes a video wall display, personal computer, or mobile device thatreceives and displays the visual data presentation.
 3. The method ofclaim 2, further comprising the step of a user added data andinformation to the visual data presentation.
 4. The method of claim 3,further comprising the step of recording and storing the visual datapresentation.
 5. The method of claim 4, further comprising the step ofdistributing and replaying on demand the visual data presentation at oneor more end-points.
 6. The method of claim 1, further comprising thestep of standardizing the alert information.
 7. The method of claim 1,further comprising arranging the visual data presentation with a definedoverall pixel space.
 8. The method of claim 1, further comprising thestep of identifying and indexing the visual data presentation as visualdata of a single critical incident to be interacted with throughcollaborative tools and to be shared with users.
 9. The method of claim1, wherein the step of searching in an automated manner accessiblesystems and databases for relevant information for the critical incidentincludes access to at least one external database.
 10. The method ofclaim 1, wherein the display visual data presentation includes at leastone of the following: graphical data, a dashboard, tabular data, a videostream from a surveillance camera, a news report, a weather broadcast,geographical information, a photograph, a video clip, a webpage, or asocial media post.
 11. The method of claim 2, further comprising thestep of a user modifying data and information of the visual datapresentation.
 12. The method of claim 2, further comprising the step ofa plurality of users adding data and information to the visual datapresentation.
 13. The method of claim 2, further comprising the step ofa plurality of users modifying data and information of the visual datapresentation.